CN102760219B - A kind of Android platform software protection system, method and apparatus - Google Patents
A kind of Android platform software protection system, method and apparatus Download PDFInfo
- Publication number
- CN102760219B CN102760219B CN201110429661.2A CN201110429661A CN102760219B CN 102760219 B CN102760219 B CN 102760219B CN 201110429661 A CN201110429661 A CN 201110429661A CN 102760219 B CN102760219 B CN 102760219B
- Authority
- CN
- China
- Prior art keywords
- core code
- application software
- file
- code
- intelligent terminal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 80
- 230000006870 function Effects 0.000 claims description 34
- 230000008569 process Effects 0.000 claims description 12
- 238000012795 verification Methods 0.000 claims description 5
- 238000004458 analytical method Methods 0.000 abstract description 28
- 238000004891 communication Methods 0.000 description 6
- 230000008859 change Effects 0.000 description 5
- 238000010586 diagram Methods 0.000 description 5
- 238000011161 development Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 4
- 239000011800 void material Substances 0.000 description 4
- 101100217298 Mus musculus Aspm gene Proteins 0.000 description 2
- 230000000840 anti-viral effect Effects 0.000 description 2
- 238000005336 cracking Methods 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 238000009826 distribution Methods 0.000 description 1
- 238000007429 general method Methods 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 230000035800 maturation Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 229910052709 silver Inorganic materials 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000003860 storage Methods 0.000 description 1
- 230000009897 systematic effect Effects 0.000 description 1
- 210000003813 thumb Anatomy 0.000 description 1
Abstract
The present invention essentially discloses one protection application software in android system and is not subject to conversed analysis and cracks system and method.Main method is: for Dalvik virtual machine in android system and linux system storehouse increase interface, make Android have the ability directly loading DEX formatted file and SO formatted file from internal memory; The core code of application software is stored in line server, encrypts and send to the application software being arranged on client after signing; Certifying signature after application software receives core code is also deciphered, then by stored in clear in internal memory, be directly loaded in system, then call code wherein, last releasing memory.The method substantially increases the difficulty that assailant carries out conversed analysis and cracks, the safety of energy available protecting Android application software.
Description
Technical field
The present invention relates to a kind of protecting computer software technology, the software especially for Android platform is anti-divulges a secret and copyright protecting system and method, server and intelligent terminal.
Background technology
At present, the Android operation system dominating exploitation by Google company has been the mobile intelligent terminal platform that global market share is the highest.The application software quantity of Android constantly increases, and establishes good software marketing pattern.The same with conventional P C platform, the successful commercialization of Android application software, has also caused their conversed analysis and has cracked.
The conversed analysis (reversinganalysis) of application software is comprised:
One, the methods such as dis-assembling, decompiling, debugging are adopted to analyze to the executable code of software, to understand the execution flow process of its code and algorithm realization etc.;
Two, the configuration file of software and data file are analyzed, to obtain the form of these files and semantic etc.;
Three, the network communication data of software is analyzed, to obtain the protocol format of software and server communication, protocol semantics, data ciphering method and data concrete meaning etc.
Wherein, rear two alanysis are based upon on the basis of first kind analysis, namely need first to analyze executable code, could further analysis configuration file, data file, network communication data etc.
By conversed analysis, assailant can obtain the trade secret in software.Such as, in the anti-viral software of mobile phone, the executable codes such as Malicious Code Detection algorithm, Feature Correspondence Algorithm, and the data file such as malicious code feature database, once victim conversed analysis obtains detail, both may utilize by other similar softwares, also may be carried out specific aim defence or attack by malicious code authors.For another example, in the e-Bank payment software of mobile phone, authentication and the financial account information of user is related to by the data of Internet Transmission, once the victims such as software code, configuration file, network communication data are thoroughly understood by conversed analysis, just likely cause further malicious attack, direct economic loss is caused to individual and bank.
Cracking (cracking) is a kind of attack with special object on conversed analysis basis.Business software uses after needing user charges.To unpaid expense family, generally do not allow to use, maybe can only use a small amount of function, maybe can only use one period of trial period.In order to ensure this strategy, business software comprises the discriminating (being called " authentication code " by the code snippet being responsible for this discriminating work below) to user's license (License) and user identity usually, to judge whether user pays.Assailant is by the conversed analysis to authentication code, and distort code execution flow journey further, distort, copy or forge associated profile, distort network data, amendment internal storage data etc., the function making unpaid expense family also can obtain paying customer just to have.This attack is referred to as to crack, and it greatly compromises the economic rights and interests of software developer, violates the relevant law of intellectual property protection.
The applied software development of Android platform generally adopts Java language.Source code is compiled into java class file, use AndroidSDK(SoftwareDevelopmentKit again, SDK (Software Development Kit)) in instrument be converted to the binary executable of DEX form, finally be packaged into APK formatted file together with software merit rating, resource file etc., i.e. Android application software installation kit.User downloads APK formatted file, and is installed to Android terminal.When application software is run, perform among the Dalvik virtual machine of the instruction in DEX formatted file in android system.
Android is the wide-open operating system of source code.No matter the instruction coding method of DEX formatted file, or the principle of work of Dalvik virtual machine, all because source code is open known to people.There are at present all kinds of conversed analysis instruments for DEX formatted file, comprise disassemblers smali, decompiling instrument dex2jar, and for the automation tools such as apktool of APK formatted file.In addition, conversed analysis and the technology cracked have occurred for many years on conventional P C platform, and the assailant of Android platform has used for reference traditional method.Under the help of these tool and methods, current assailant can carry out conversed analysis to most Android application software easily and crack.
Such as, the common flow process that cracks is: use apktool to untie APK file, apktool can call smali and carry out dis-assembling to DEX formatted file wherein; Assailant analyzes the dis-assembling result of smali, understands the code flow of this application software; Then find authentication code, the part of key is modified, such as, conditional jump instructions during authentication is made into unconditional jump instruction; Re-use the code that these revised by apktool and be repackaged into APK formatted file, and again sign.So just obtain one crack after APK file.
In addition, Android application program can also use NDK(NativeDevelopmentKit, primary development kit) exploitation.Android system runs on Linux, and the Dalvik virtual machine at each application software place is an independently Linux process.AndroidNDK provides so a kind of development approach: programmer writes the partial function of software by C language, by the instrument of NDK source code is compiled as the dynamic link file (SO formatted file) in Linux; Write other functions with Java language, be compiled as DEX formatted file with SDK instrument; Finally by SDK, SO formatted file is packaged as APK formatted file together with DEX formatted file.Operationally, the code in DEX loads SO formatted file, and calls its function interface provided.
SO formatted file in NDK exploitation is the one of LinuxELF format standard, and order format is wherein ARM instruction set or the Thumb instruction set of ARM architecture.There are the decompiling such as disassemblers and the x86/ARMDecompiler instruments such as IDAPro can carry out conversed analysis to this file at present.
This platform defence conversed analysis and crack method comprise at present:
One, Code obfuscation.Namely automatically by equivalent but that the code of redundancy complexity replacement developer is hand-written Java source code, the workload that assailant carries out conversed analysis is improved.
Two, character string information is changed.In high-quality Java source code, bag, class, method, name of variables often have good readability, namely have clear and definite implication, therefore can guess its function by title.DEX file intactly saves these names, for conversed analysis provides conveniently.Such as, but most of name only uses in application program inside, self-defining class.If these names are replaced with insignificant character string, the operation of program can't be affected, but conversed analysis can be made to be absorbed in understanding difficulty.ProGuard instrument in AndroidSDK carrys out protection software in this way with regard to profit.
Three, NDK exploitation is used.As previously mentioned, the understanding to ARM form assembly language is related to the conversed analysis of SO file, improve the difficulty of software code being carried out to conversed analysis to a certain extent.
There is following problem in these methods:
1. be no matter the data after code or encryption, all with document form long-term existence among Android installation file and Android device, assailant can obtain easily;
2., by Code obfuscation, code still can be disassembled and decompiling, just improves the time understood required for code;
3., by change character string information, the logic of code itself does not change, and still can be disassembled and decompiling, equally just improve the time understood required for code;
4. be familiar with ARM form assembly language along with assailant understands gradually, and along with the continuous maturation of this platform decompiling instrument, the conversed analysis difficulty adopting the method for NDK exploitation to improve can be more and more lower.
In theory, the execution of application software in computing equipment finally all cannot be hidden by conversed analysis.The essence of software protection improves constantly conversed analysis and the difficulty cracked and time cost, and making assailant obtain valuable information needs the cost paid higher than its obtainable interests.
Software protection can bring extra software development cost, such as, increase development difficulty, extend the development time etc.Therefore, from the angle the need of special protection, the code of application software can be divided into two parts in logic:
One, non-core code, does not need special protection, such as, with interface, the multiplexing third party library code etc. of user interactions;
Two, core code, needs special protection, such as important algorithm, authentication code, important configuration data etc.
How these two parts divide, and do not have general method, are determined by the actual conditions of each application software.Such as, in anti-viral software, Malicious Code Detection algorithm, Feature Correspondence Algorithm etc. are all nucleus modules; In Net silver software, it is all nucleus module that user logs in code, financial transaction code etc.; In charge business software, paying code, authentication code etc. are all nucleus modules.
The invention still further relates to the amendment to DEX file Dynamic loading technique in android system.
Under normal circumstances, the DEX file in Android application software is the position of being specified by systematic conservation when mounted.In order to the ability of expanded application software, Android provides DEX file Dynamic loading technique.Specifically, application software operationally, the APK form do not installed before can loading one by dalvik.system.DexClassLoader class or JAR formatted file, and the DEX formatted file of " classes.dex " by name that comprise in this file is loaded on Dalvik virtual machine; Further, by methods such as such findClass (), the code realized in this DEX formatted file can be called.
Up to the present Android version (from 1.0 to 4.0), following requirements is there is: APK or the JAR formatted file containing " classes.dex " must be a physical file, in the nand flash memory that the equipment that is kept at is built-in or external SD card by said method dynamic load DEX formatted file; During dynamic load, system can generate a temporary file in the built-in nand flash memory of equipment or external SD card, and this file is the optimization (expansion .odex by name) to DEX formatted file.
Summary of the invention
For above technical matters, the present invention essentially discloses one protection application software in android system and is not subject to conversed analysis and cracks system and method.For Dalvik virtual machine in android system and linux system storehouse increase interface, Android is made to have the ability directly loading DEX formatted file and SO formatted file from internal memory; The core code of application software is stored in line server, encrypts and send to the application software being arranged on client after signing; Certifying signature after application software receives core code is also deciphered, then by stored in clear in internal memory, be directly loaded in system, then call code wherein, last releasing memory.The method substantially increases the difficulty that assailant carries out conversed analysis and cracks, the safety of energy available protecting Android application software.
The present invention is made up of three parts:
1, the Android operation system revised, realizes the dynamic load of DEX formatted file in internal memory;
2, the non-core code of application software, be arranged in intelligent terminal (comprising mobile phone, panel computer etc.), and this intelligent terminal uses the Android operation system of above-mentioned amendment;
3, the core code of application software, is stored in server online for a long time.
First, the source code of Android operation system is modified.Dalvik virtual machine increases such function, Dalvik virtual machine is made can directly to load a DEX formatted file from the memory address of specifying, and make application program can pass through bag name, class name, the method name of wherein code, call these codes and perform in Dalvik virtual machine.The Linux of Android bottom increases such function, makes Linux can directly load a SO formatted file from the memory address of specifying, and make application program can pass through the api interface of wherein code, call these codes and perform in Linux.
The core code of application software is the DEX formatted file be compiled into by the instrument of Java source code in AndroidSDK, or the SO formatted file be compiled into by the instrument of C source code in AndroidNDK.The server storing these core codes receives the request that in intelligent terminal, the non-core code of application software is sent, and the core code of being asked is encrypted, carried out digital signature, then sends to the application software in intelligent terminal.
The non-core code of application software is positioned among complete Android application program (i.e. APK formatted file).This application program is openly distributed by software developer, and user is mounted in intelligent terminal.Non-core code, except completing the function required for application software, also possesses following functions: send request to server, receives the core code sent, and verifies its digital signature; Apply for one section of internal memory, by core code deciphering to this section of internal memory; Be DEX form or SO form according to core code, make Dalvik virtual machine or Linux directly load core code from this section of internal memory, then called the function of core code as required by api interface; Finally when application software does not re-use core code, discharge this section of internal memory.
Specifically, the invention provides a kind of Android platform software protection system, comprise intelligent terminal and line server:
Described intelligent terminal comprises the non-core code of amended Android operation system and application software; The source code of described amended Android operation system to Android operation system is modified, and realizes the dynamic load of core code in internal memory of application software; The non-core code of described application software is among complete Android application program, possesses the function beyond the function required for application software, comprise: send request to line server, receive the core code that line server is sent, through the core code of loading application software in internal memory after checking, called the core code of application software as required by api interface;
Line server stores the core code of application software, receives the request that in intelligent terminal, the non-core code of application software is sent, and requested core code is sent to the non-core code of the application software in intelligent terminal after process.
The core code of described system software comprises DEX formatted file and SO formatted file.
The line server of described system stores the core code of application software, receive the request that the non-core code of application software is sent in intelligent terminal, some or all of requested core code is encrypted and/or sends to the non-core code of the application software in intelligent terminal after requested core code is carried out digital signature.
Present invention also offers a kind of source code amending method of Android operation system, be applicable to described system, described method comprises:
To the Dalvik virtual machine of Android operation system, the function of dalvik.system.DexClassLoader class in expansion AndroidFramework, dalvik.system.DexClassLoader class after expansion provides calling interface, receive the DEX formatted file in internal memory, load described DEX formatted file in the mode loading DEX formatted file;
In Android source code, the source code part of linux kernel and system library increases an interface, and described interface loads SO formatted file from the memory address of specifying;
Compile whole Android source code engineering, generate corresponding system image and developing instrument.
The .odex temporary file produced during DEX formatted file described in described method loads is kept in internal memory.
Present invention also offers a kind of Android platform software guard method, be applicable to described system, described method comprises:
The core code of line server to the part or all of application software stored is encrypted;
The core code of line server to the application software stored carries out digital signature;
The file at the core code place of application software and corresponding ciphertext are sent to intelligent terminal.
A kind of server provided by the invention, the line server in system described in described server, described server comprises:
Ciphering unit, for being encrypted the core code of the part or all of application software stored;
Digital signature unit, for carrying out digital signature to the core code of the application software stored;
Transmitting element, sends to intelligent terminal for the file at the core code place by application software and corresponding ciphertext.
A kind of Android platform software guard method provided by the invention, be applicable to described system, described method comprises:
The file at the core code place of the application software that intelligent terminal for reception line server sends and corresponding ciphertext;
The core code file of the software that is applied also is deciphered according to the file verification digital signature received;
By the core code file copy of application software in internal memory, the interface calling amended Android operation system completes the loading of core code file;
The core code of application software is called as required by api interface;
Discharge the internal memory storing core code.
Further, intelligent terminal, before the file receiving the core code place of application software that line server sends and corresponding ciphertext, sends the request needing application software core code to line server.
The invention provides a kind of intelligent terminal, described intelligent terminal is the intelligent terminal in described system, and described intelligent terminal comprises amended Android operation system, also comprises:
Receiving element, for receiving the file at the core code place of the application software that line server sends and corresponding ciphertext;
Authentication unit, for also deciphering the core code file of the software that is applied according to the file verification digital signature received;
Loading unit, for by the core code file copy of application software in internal memory, the interface calling amended Android operation system completes the loading of core code file;
Call unit, for calling the core code of application software as required by api interface;
Releasing unit, for dischargeing the internal memory storing core code.
Described intelligent terminal also comprises:
Transmitting element, for sending the request needing application software core code to line server.
The invention has the beneficial effects as follows:
One, compared with existing method of software Protection, the method for the invention makes the extremely difficult core code obtaining application software of assailant, thus cannot carry out conversed analysis to it.
First, the application software of open distribution does not comprise core code, assailant cannot as downloading to application software from software market or download website in the past, directly static dis-assembling is done to it and just can see all codes, obtain this partial code this application software to be run, make its connection server.
Secondly, the communication on server and intelligent terminal between application software adopts encryption and digital signature completely, even if assailant has captured network communication data, when not having key, cannot solve core code expressly.Use digital signature, also ensure that assailant pseudo-ly in this course cannot produce false core code, gain application software by cheating and load.
Finally, in the Android operation system of intelligent terminal, core code is only present in internal memory all the time, and only application software need wherein function time be present in internal memory, and not to be present in the built-in nand flash memory of equipment or external SD card with document form.At present, the Dalvik virtual machine that Android application program is run is positioned at independently in Linux process, and process authority is this application program, and exclusive user creates, and assailant is difficult to the virtual memory space reading core code place.Even if assailant can read, due to dynamic assignment when the memory headroom storing core code is operation, consider the complicacy of Linux and Dalvik in memory management, assailant is also difficult to accurately find core code which address concrete in internal memory, and the physical length of this section of internal memory.In addition, current linux kernel and Android4.0 start to adopt ASLR(address space to distribute randomization later) technology, this increase further assailant locate core code memory address difficulty.
Moreover, even if assailant finally obtains core code, after its conversed analysis and amendment, also extremely difficultly implanted in the memory headroom of application software place process, be more difficult to requirement application program and load this part of implanted application heap (this relates to new Memory Allocation, the on-the-fly modifying of programmed instruction).Therefore, cannot crack application software.
In addition, Software Protection Technique of the present invention is not identical with the protection philosophy of other existing Software Protection Technique, does not therefore conflict yet, and jointly can use with other resist technologies existing, such as Code obfuscation, change character string information etc.Therefore, this scheme can use jointly with prior art, more all sidedly protection software safety.
Accompanying drawing explanation
In order to be illustrated more clearly in the present invention or technical scheme of the prior art, be briefly described to the accompanying drawing used required in embodiment or description of the prior art below, apparently, the accompanying drawing that the following describes is only some embodiments recorded in the present invention, for those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.
Fig. 1 is a kind of Android platform software protection system of the present invention schematic diagram;
Fig. 2 is the source code amending method process flow diagram of a kind of Android operation system of the present invention;
Fig. 3 is line server workflow diagram of the present invention;
Fig. 4 is line server system schematic of the present invention;
Fig. 5 is intelligent terminal workflow diagram of the present invention;
Fig. 6 is intelligent terminal system schematic diagram of the present invention.
Embodiment
In order to make those skilled in the art person understand technical scheme in the embodiment of the present invention better, and enable above-mentioned purpose of the present invention, feature and advantage become apparent more, below in conjunction with accompanying drawing, technical scheme in the present invention is described in further detail.
First introduce a kind of Android platform software protection system provided by the invention, as shown in Figure 1, comprise intelligent terminal 101 and line server 102:
Described intelligent terminal 101 comprises the non-core code of amended Android operation system and application software; The source code of described amended Android operation system to Android operation system is modified, and realizes the dynamic load of core code in internal memory of application software; The non-core code of described application software is among complete Android application program, possesses the function beyond the function required for application software, comprise: send request to line server 102, receive the core code that line server 102 is sent, through the core code of loading application software in internal memory after checking, called the core code of application software as required by api interface;
Line server 102 stores the core code of application software, receives the request that in intelligent terminal 101, the non-core code of application software is sent, and requested core code is sent to the non-core code of the application software in intelligent terminal 101 after process.
The core code of application software comprises DEX formatted file and SO formatted file.
Line server 102 stores the core code of application software, receive the request that the non-core code of application software is sent in intelligent terminal 101, some or all of requested core code is encrypted and/or sends to the non-core code of the application software in intelligent terminal 101 after requested core code is carried out digital signature.
The present invention includes the method for amendment Dalvik virtual machine and linux system, main flow as shown in Figure 2.
S201: amendment Dalvik virtual machine
The groundwork of amendment Dalvik virtual machine is, the ability of dalvik.system.DexClassLoader class in expansion AndroidFramework, it is made to receive the data of one section of DEX formatted file in internal memory, load this segment data in the mode loading DEX formatted file, and the interface that calls wherein code similar with existing interface is provided.In addition, consider from the angle of safety, the .odex temporary file produced in loading procedure also will be made not to be stored in the built-in nand flash memory of equipment or external SD card, but be also kept in internal memory.
In the source code of Android4.0.1_r1 version, achieve a part of code of above-mentioned functions.
Specifically, in the libcore/dalvik/src/main/java/dalvik/system/DexFile.java file of source code, there is following JNI interface statement: nativeprivatestaticintopenDexFile (byte [] fileContents), the function of this interface reads a DEX formatted file from the byte arrays internal memory.The function of this JNI interface realizes the dalvik/vm/native/dalvik_system_DexFile.cpp file (the 248th row) being positioned at source code, function name is Dalvik_dalvik_system_DexFile_openDexFile_bytearray, it have invoked dvmRawDexFileOpenArray function, and the realization of the latter is positioned at the dalvik/vm/RawDexFile.cpp file of source code (the 249th row).Analyze these two functions known, it is when a structure DEX formatted file structure, and the .odex temporary file of generation has also been kept in internal memory.
Next start to increase some codes in source code, to complete the amendment to Dalvik virtual machine.
In the libcore/dalvik/src/main/java/dalvik/system/DexFile.java file of source code, for DexFile class increases a constructed fuction, prototype is privateDexFile (byte [] fileContents, intflags), its code and existing privateDexFile (StringsourceName, StringoutputName, intflags) code of function is the same, but openDexFile wherein calls use that JNI interface foregoing.
In the libcore/dalvik/src/main/java/dalvik/system/DexFile.java file of source code, for DexFile class increases a method, prototype is staticpublicDexFileloadDex (byte [] fileContents, intflags), its code is similar to existing loadDex method, and this DexFile constructed fuction realized is called in difference above.
In the libcore/dalvik/src/main/java/dalvik/system/DexPathList.j ava file of source code, for DexPathList class increases a method, prototype is privatestaticDexFileloadDexFile (byte [] fileContents), code is similar to existing loadDexFile method, but calls the loadDex method of the DexFile class realized above.
In the libcore/dalvik/src/main/java/dalvik/system/DexPathList.j ava file of source code, for DexPathList class increases a method, prototype is privatestaticElement [] makeDexElements (byte [] fileContents), code is similar to existing makeDexElements method, but in the if statement of the 207th row, only enter Article 1 branch, and call the loadDexFile method of the DexPathList class realized above.
In the libcore/dalvik/src/main/java/dalvik/system/DexPathList.j ava file of source code, for DexPathList class increases a constructed fuction, prototype is publicDexPathList (ClassLoaderdefiningContext, byte [] fileContents), code is similar to existing constructed fuction, but calls the makeDexElements method of the DexPathList class realized above.
In the libcore/dalvik/src/main/java/dalvik/system/BaseDexClassL oader.java file of source code, for BaseDexClassLoader class increases a constructed fuction, prototype is publicBaseDexClassLoader (byte [] fileContents), code is similar to existing constructed fuction, but calls the constructed fuction of the DexPathList class realized above.
In the libcore/dalvik/src/main/java/dalvik/system/DexClassLoade r.java file of source code, for DexClassLoader class increases a constructed fuction, prototype is publicDexClassLoader (byte [] fileContents), code is the same with existing constructed fuction, but calls the constructed fuction of the BaseDexClassLoader class realized above.
So far, we obtain and meet amended Dalvik virtual machine source code of the presently claimed invention.
S202: amendment linux system
The fundamental purpose of amendment linux system is, the linux kernel in Android source code engineering and system library part increase partial code, and make it increase an interface, the major function of this interface is the data loading one section of SO formatted file from the memory address of specifying.
This work in the industry cycle has accomplished in many ways at present.Such as, the system call of a dlopen_mem () is increased in glibc, prototype is void*dlopen_mem (char*addr, size_tlen, intflag), code be existing dlopen () system call in glibc java standard library source code basis on amendment form.Specifically, first parameter of dlopen () is the disk path of the SO formatted file that will open, and it can be opened this file and be read out by its full content.In the realization of dlopen_mem (), directly read data from parameter addr and len, then continue the follow-up code performing dlopen ().
So far, we obtain and meet amended linux system source code of the presently claimed invention.
S203: compiling Android engineering
Adopt conventional method by whole Android source code engineering compiling, generate corresponding system image, SDK developing instrument, NDK developing instrument.
Like this, in the SDK developing instrument obtained, just can use newly-increased DexClassLoader (byte [] fileContents) interface, dynamic load DEX formatted file from internal memory; In the NDK developing instrument obtained, just can use newly-increased dlopen_mem () system call, dynamic load SO formatted file from internal memory; In new system image, the application software employing above-mentioned interface and system call just can normally be run.
Present invention also offers the workflow of the line server storing core code, as shown in Figure 3, comprising:
S301: encryption core code
Core code exists with the form of DEX formatted file or SO formatted file, adopts general cryptographic algorithm to be encrypted to all or part of of core code, to ensure its confidentiality in transmitting procedure.Can symmetric cryptography be used, also can use asymmetric encryption.
Such as, select symmetric encipherment algorithm AES, the key of use is designated as akey, is encrypted the file f ile at core code place, obtains the file f ile_enc after encrypting.
Select rivest, shamir, adelman, such as a RSA again, the PKI of use is designated as rkey_pub, and private key is designated as rkey_pri.Use private key rkey_pri to AES key akey encryption, obtain the ciphertext akey_enc of akey.
Here, the PKI that RSA Algorithm uses and private key are just generating in advance, and are programmed in corresponding client application software by PKI rkey_pub.
S302: signature core code
General Digital Signature Algorithm is adopted to sign to core code, to ensure the integrality of file.
Such as, the most classical a kind of digital signature method is adopted.Use hash algorithm SHA1 to carry out digital digest to core code place file cipher text file_enc, obtain a cryptographic hash hvalue.
Use RSA Algorithm and above-mentioned private key rkey_pri to be encrypted this cryptographic hash hvalue, obtain ciphertext hvalue_enc.
S303: send to client
By core code place file cipher text file_enc, the ciphertext akey_enc of aes algorithm key used, the ciphertext hvalue_enc of cryptographic hash, together send to client.
Accordingly, present invention also offers a kind of server, as shown in Figure 4, described server is the line server 102 in described system, and described server comprises:
Ciphering unit 401, for being encrypted the core code of the part or all of application software stored;
Digital signature unit 402, for carrying out digital signature to the core code of the application software stored;
Transmitting element 403, sends to intelligent terminal for the file at the core code place by application software and corresponding ciphertext.
Present invention also offers the workflow of non-core code in application software, in the application software being installed to client, contain non-core code.These codes can be divided into two parts: one, relevant to this software embody rule code; Two, the code loading core code is responsible for.The present invention only relates to rear portion code, provides its main working process and implementation method below.As shown in Figure 5, comprising:
S501: receive file_enc, akey_enc, hvalue_enc that S303 sends to client from server.
S502: certifying digital signature, to ensure the integrality of file.
Such as, to the endorsement method described in S302, first use is selected in advance and is programmed into the RSA PKI rkey_pub of application software, and deciphering hvalue_enc, obtains cryptographic hash hvalue.
Next, with SHA1 algorithm, digital digest is carried out to the file_enc sent, obtain another cryptographic hash hvalue2, whether identically compare hvalue with hvalue2.
If not identical, then think that the core code received is incomplete, be likely tampered, report abnormal and exit software.
If identical, then think that the core code received is complete, enter next step.
S503: decipher akey_enc with RSA PKI rkey_pub, obtain aes algorithm key akey.With aes algorithm, using akey as key, deciphering file_enc, obtains the complete content of core code place file f ile.
S504: be DEX form or SO form according to core code place file, applies for the internal memory of this file size, and is copied to wherein by file content in Java or in C.
Specifically, if file is DEX form, then adopt the byte array record memory address in Java language, by new method application internal memory, use System.arraycopy method copy; If file is SO form, then in NDK, use the char* pointer record memory address of C language, by malloc function application internal memory, use memcpy function copy, use int type variable record data length.
S505: call the new function interface that amendment Dalvik virtual machine and linux system before this obtain, directly load core code from the internal memory of back.
If file is DEX form, then call publicDexClassLoader (byte [] fileContents) constructed fuction obtained in S201, using memory address as parameter, obtain a DexClassLoader object, namely complete the dynamic load of DEX format object;
If file is SO form, then call the void*dlopen_mem (char*addr obtained in S202, size_tlen, intflag) system call, its parameter addr is the memory address obtained in S504, and parameter len is the data length recorded in S504, and parameter f lag is 0, obtain the handle of a void* type, namely complete the dynamic load of SO format object.
S506: according to the real needs of application software, calls the class in core code, method, function etc.
If file is DEX form, then uses the loadClass () method of the DexClassLoader object obtained in S505, obtain such Class object according to the title of java class in core code; Further, use the getDeclaredMethod method of this Class object, according to the title of the method for the java class in core code, obtain the Method object of the method in such.Now, just can call the invoke method of this Method object, call the method.
If file is SO form, then uses the handle of the void* type obtained in S505, according to the title of C language function in core code, by dlsym () system call, obtain the pointer of this function.Now, just can directly call this function pointer, run the code wherein realized.
S507: but when application software no longer needs to use core code, discharge the internal memory storing core code.When core code place file is DEX form, then call the delete method of byte [] object in Java language; When file is SO form, then call the free method in C language.
Accordingly, present invention also offers a kind of intelligent terminal, described intelligent terminal is the intelligent terminal 101 in described system, and described intelligent terminal 101 comprises amended Android operation system, also comprises:
Receiving element 601, for receiving the file at the core code place of the application software that line server sends and corresponding ciphertext;
Authentication unit 602, for also deciphering the core code file of the software that is applied according to the file verification digital signature received;
Loading unit 603, for by the core code file copy of application software in internal memory, the interface calling amended Android operation system completes the loading of core code file;
Call unit 604, for calling the core code of application software as required by api interface;
Releasing unit 605, for dischargeing the internal memory storing core code.
Described intelligent terminal 101, also comprises:
Transmitting element 600, for sending the request needing application software core code to line server.
In this instructions, the embodiment of method adopts the mode of going forward one by one to describe, and for the embodiment of system, because it is substantially similar to embodiment of the method, so description is fairly simple, relevant part illustrates see the part of embodiment of the method.
Although depict the present invention by embodiment, those of ordinary skill in the art know, the present invention has many distortion and change and do not depart from spirit of the present invention, and the claim appended by wishing comprises these distortion and change and do not depart from spirit of the present invention.
Claims (7)
1. an Android platform software protection system, is characterized in that, comprises intelligent terminal and line server:
Described intelligent terminal comprises the non-core code of amended Android operation system and application software; The source code of described amended Android operation system to Android operation system is modified, and realizes the dynamic load of core code in internal memory of application software; The non-core code of described application software is among complete Android application program, possesses the function beyond the function required for application software, comprise: send request to line server, receive the core code that line server is sent, through the core code of loading application software in internal memory after checking, called the core code of application software as required by api interface; When application software does not re-use described core code, then discharge the internal memory storing described core code;
Line server stores the core code of application software, receives the request that in intelligent terminal, the non-core code of application software is sent, and requested core code is sent to the non-core code of the application software in intelligent terminal after process.
2. Android platform software protection system as claimed in claim 1, it is characterized in that, the core code of application software comprises DEX formatted file and SO formatted file.
3. Android platform software protection system as claimed in claim 1; it is characterized in that, the described non-core code of the application software in intelligent terminal that requested core code sent to after process is: be encrypted by some or all of requested core code and/or send to the non-core code of the application software in intelligent terminal after requested core code is carried out digital signature.
4. an Android platform software guard method, is characterized in that, is applicable to system according to claim 1, and described method comprises:
The file at the core code place of the application software that intelligent terminal for reception line server sends and corresponding ciphertext;
The core code file of the software that is applied also is deciphered according to the file verification digital signature received;
By the core code file copy of application software in internal memory, the interface calling amended Android operation system completes the loading of core code file;
The core code of application software is called as required by api interface;
Discharge the internal memory storing core code.
5. Android platform software guard method as claimed in claim 4; it is characterized in that; intelligent terminal, before the file receiving the core code place of application software that line server sends and corresponding ciphertext, sends the request needing application software core code to line server.
6. an intelligent terminal, it is characterized in that described intelligent terminal is for the intelligent terminal in system described in claim 1, described intelligent terminal comprises amended Android operation system, also comprises:
Receiving element, for receiving the file at the core code place of the application software that line server sends and corresponding ciphertext;
Authentication unit, for also deciphering the core code file of the software that is applied according to the file verification digital signature received;
Loading unit, for by the core code file copy of application software in internal memory, the interface calling amended Android operation system completes the loading of core code file;
Call unit, for calling the core code of application software as required by api interface;
Releasing unit, for dischargeing the internal memory storing core code.
7. intelligent terminal as claimed in claim 6, is characterized in that, also comprise:
Transmitting element, for sending the request needing application software core code to line server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110429661.2A CN102760219B (en) | 2011-12-20 | 2011-12-20 | A kind of Android platform software protection system, method and apparatus |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110429661.2A CN102760219B (en) | 2011-12-20 | 2011-12-20 | A kind of Android platform software protection system, method and apparatus |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102760219A CN102760219A (en) | 2012-10-31 |
| CN102760219B true CN102760219B (en) | 2015-12-16 |
Family
ID=47054674
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201110429661.2A Active CN102760219B (en) | 2011-12-20 | 2011-12-20 | A kind of Android platform software protection system, method and apparatus |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102760219B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106250771A (en) * | 2016-07-27 | 2016-12-21 | 北京邮电大学 | A kind of encryption method for Android program code |
Families Citing this family (34)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103809992B (en) * | 2012-11-13 | 2018-01-09 | 中兴通讯股份有限公司 | A kind of method and device of the compatible different file format java applications of Dalvik virtual machine |
| CN103365699B (en) * | 2012-12-21 | 2016-08-03 | 北京安天电子设备有限公司 | System API based on APK and the extracting method of character string and system when running |
| CN103902857B (en) * | 2012-12-25 | 2017-11-14 | 深圳市腾讯计算机系统有限公司 | A kind of guard method of software program and device |
| CN104346572B (en) * | 2013-07-25 | 2017-11-14 | 中国科学院信息工程研究所 | A kind of general external intelligent terminal secure operating environment construction method |
| CN104573416B (en) * | 2013-10-25 | 2018-07-17 | 腾讯科技（深圳）有限公司 | A kind of method and device for generating application installation package, executing application |
| CN103544414B (en) * | 2013-10-25 | 2015-08-19 | 江苏通付盾信息科技有限公司 | A kind of degree of depth Code obfuscation method of android system application |
| CN103593185B (en) * | 2013-11-04 | 2017-01-04 | 浙江大学 | The method that many android system based on single linux kernel share input display device |
| CN103902910B (en) * | 2013-12-30 | 2016-07-13 | 北京奇虎科技有限公司 | Detect method and the device of malicious code in intelligent terminal |
| WO2015101096A1 (en) | 2013-12-30 | 2015-07-09 | 北京奇虎科技有限公司 | Method and device for detecting malicious code in smart terminal |
| CN104866504B (en) * | 2014-02-25 | 2018-07-06 | 北京娜迦信息科技发展有限公司 | A kind of method and device that Function Extension is carried out to Android software |
| CN104866734B (en) * | 2014-02-25 | 2018-10-09 | 北京娜迦信息科技发展有限公司 | A kind of guard method of DEX file and device |
| CN104866294B (en) * | 2014-02-25 | 2018-06-15 | 北京娜迦信息科技发展有限公司 | A kind of method and device for extending Android software function |
| CN104866741A (en) * | 2014-02-25 | 2015-08-26 | 北京娜迦信息科技发展有限公司 | APK (Android package) file protecting method and device |
| CN105590056B (en) | 2014-10-22 | 2019-01-18 | 中国银联股份有限公司 | Dynamic application function control method based on environment measuring |
| CN104298932B (en) * | 2014-10-27 | 2017-12-12 | 中国建设银行股份有限公司 | A kind of call method and device of SO files |
| CN104318155A (en) * | 2014-11-18 | 2015-01-28 | 刘鹏 | Dynamic loading method capable of guarding against reverse APK file |
| CN104539432B (en) * | 2014-12-31 | 2016-09-28 | 深圳市奇付通科技有限公司 | A kind of method and apparatus that file is signed |
| CN105760721B (en) * | 2016-01-29 | 2019-02-12 | 北京奇虎科技有限公司 | A kind of software reinforcement method and system |
| CN105843635A (en) * | 2016-03-01 | 2016-08-10 | 乐视云计算有限公司 | Application localized installation method and apparatus of Android device |
| CN105930695B (en) * | 2016-04-11 | 2019-03-19 | 江苏通付盾科技有限公司 | A kind of guard method of Software Development Kit and device |
| CN106355049B (en) * | 2016-08-19 | 2020-02-11 | 北京奇虎科技有限公司 | Method and device for reinforcing SO file of dynamic link library of android installation package |
| CN107871065B (en) * | 2016-09-27 | 2019-12-20 | 武汉安天信息技术有限责任公司 | Method and device for protecting dex file in Dalvik mode |
| CN108229148B (en) * | 2016-12-21 | 2022-06-21 | 武汉安天信息技术有限责任公司 | Sandbox unshelling method and sandbox unshelling system based on Android virtual machine |
| CN108334756B (en) * | 2017-01-20 | 2020-05-12 | 武汉斗鱼网络科技有限公司 | Interference method and device for decompiling recursive descent type analyzer |
| CN108733988B (en) * | 2017-04-19 | 2023-01-24 | 北京梆梆安全科技有限公司 | Method for protecting executable program on android platform |
| CN107977553B (en) * | 2017-12-25 | 2020-07-10 | 中国电子产品可靠性与环境试验研究所 | Method and device for security reinforcement of mobile application program |
| CN108595989B (en) * | 2018-03-15 | 2020-06-30 | 杭州电子科技大学 | Mobile APP safety protection system and method under iOS |
| CN109150956B (en) * | 2018-06-25 | 2021-04-16 | 百度在线网络技术（北京）有限公司 | Method, device and equipment for realizing SDK pushing and computer storage medium |
| CN110765423A (en) * | 2018-07-27 | 2020-02-07 | 北京京东尚科信息技术有限公司 | Application program confusion encryption method and device |
| CN109255235B (en) * | 2018-09-17 | 2021-08-24 | 西安电子科技大学 | Mobile application third-party library isolation method based on user state sandbox |
| CN110046479B (en) * | 2019-03-21 | 2023-02-28 | 腾讯科技（深圳）有限公司 | Link library file anti-debugging method and device based on android operating system |
| CN111651156A (en) * | 2020-06-04 | 2020-09-11 | 广州鲁邦通物联网科技有限公司 | Software development kit adaptive to multiple development languages and calling method |
| CN112084490A (en) * | 2020-09-09 | 2020-12-15 | 南京烽火星空通信发展有限公司 | Method and system for realizing protection of software source code based on Linux kernel calling |
| CN113642021A (en) * | 2021-08-20 | 2021-11-12 | 深信服科技股份有限公司 | Business code submitting method, processing method, device and electronic equipment |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6343280B2 (en) * | 1998-12-15 | 2002-01-29 | Jonathan Clark | Distributed execution software license server |
| US7634521B1 (en) * | 2006-04-27 | 2009-12-15 | Symantec Corporation | Technique for scanning stealthed, locked, and encrypted files |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1606027A (en) * | 2003-10-10 | 2005-04-13 | 深圳市派思数码科技有限公司 | Method for software copyright protection by utilizing fingerprint and application apparatus thereof |
| CN102087605B (en) * | 2011-01-28 | 2014-05-07 | 宇龙计算机通信科技(深圳)有限公司 | Android-based platform application installation control method and system |
| CN102236757A (en) * | 2011-06-30 | 2011-11-09 | 北京邮电大学 | Software protection method and system applicable to Android system |
-
2011
- 2011-12-20 CN CN201110429661.2A patent/CN102760219B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6343280B2 (en) * | 1998-12-15 | 2002-01-29 | Jonathan Clark | Distributed execution software license server |
| US7634521B1 (en) * | 2006-04-27 | 2009-12-15 | Symantec Corporation | Technique for scanning stealthed, locked, and encrypted files |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106250771A (en) * | 2016-07-27 | 2016-12-21 | 北京邮电大学 | A kind of encryption method for Android program code |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102760219A (en) | 2012-10-31 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102760219B (en) | A kind of Android platform software protection system, method and apparatus | |
| KR101471589B1 (en) | Method for Providing Security for Common Intermediate Language Program | |
| US20210349712A1 (en) | Secure application distribution systems and methods | |
| CN101176100B (en) | Methods and apparatus for generating endorsement credentials for software-based security coprocessors | |
| US20180260199A1 (en) | Method and apparatus for intermediate representation of applications | |
| Pappas et al. | CloudFence: Data flow tracking as a cloud service | |
| US20170116410A1 (en) | Software protection | |
| CN109992987B (en) | Script file protection method and device based on Nginx and terminal equipment | |
| CN104462959A (en) | Reinforcement protection method, sever and system for android app | |
| CN101872404B (en) | Method for protecting Java software program | |
| CN103886230A (en) | Software copyright protection method of android system and system thereof | |
| CN104268444A (en) | Cloud OS Java source code protection method | |
| CN109844748A (en) | Security service of the trustship in virtual secure environment | |
| CN114547558A (en) | Authorization method, authorization control method and device, equipment and medium | |
| Ozkan et al. | Security analysis of mobile authenticator applications | |
| Elrom et al. | Eos. io wallets and smart contracts | |
| CN107871066B (en) | Code compiling method and device based on android system | |
| Pan et al. | Advertisement removal of Android applications by reverse engineering | |
| US11809575B1 (en) | Platform and method for assessment and verification of Software Bill of Materials (SBOM) and vulnerabilities across a software supply chain life cycle using blockchain | |
| CN110597496B (en) | Method and device for acquiring bytecode file of application program | |
| Tedeschi et al. | Information security and threats in mobile appliances | |
| CN116249980A (en) | Software access through heterogeneous encryption | |
| DONG et al. | Sesoa: Security enhancement system with online authentication for android apk | |
| JP2010535372A (en) | Computer-implemented method and system for embedding and authenticating auxiliary information in digitally signed content | |
| Ménétrey et al. | A Comprehensive Trusted Runtime for WebAssembly with Intel SGX |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C53 | Correction of patent for invention or patent application | ||
| CB02 | Change of applicant information |
Address after: 100080 Haidian District City, Zhongguancun, the main street, No. 1 Hailong building, room 1415, room 14 Applicant after: Beijing Antiy Electronic Installation Co., Ltd. Address before: 100084, 2B-521, bright city, No. 1, Nongda South Road, Beijing, Haidian District Applicant before: Beijing Antiy Electronic Installation Co., Ltd. |
|
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CP03 | Change of name, title or address |
Address after: 100080 Beijing city Haidian District minzhuang Road No. 3, Tsinghua Science Park Building 1 Yuquan Huigu a Patentee after: Beijing ahtech network Safe Technology Ltd Address before: 100080 Haidian District City, Zhongguancun, the main street, No. 1 Hailong building, room 1415, room 14 Patentee before: Beijing Antiy Electronic Installation Co., Ltd. |
|
| CP03 | Change of name, title or address | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Android platform software protecting system, method and equipment Effective date of registration: 20170821 Granted publication date: 20151216 Pledgee: CITIC Bank Harbin branch Pledgor: Beijing ahtech network Safe Technology Ltd Registration number: 2017990000776 |
|
| PC01 | Cancellation of the registration of the contract for pledge of patent right | ||
| PC01 | Cancellation of the registration of the contract for pledge of patent right |
Date of cancellation: 20180817 Granted publication date: 20151216 Pledgee: CITIC Bank Harbin branch Pledgor: Beijing ahtech network Safe Technology Ltd Registration number: 2017990000776 |
|
| PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Android platform software protecting system, method and equipment Effective date of registration: 20180817 Granted publication date: 20151216 Pledgee: CITIC Bank Harbin branch Pledgor: Beijing ahtech network Safe Technology Ltd Registration number: 2018990000700 |
|
| PC01 | Cancellation of the registration of the contract for pledge of patent right | ||
| PC01 | Cancellation of the registration of the contract for pledge of patent right |
Date of cancellation: 20191021 Granted publication date: 20151216 Pledgee: CITIC Bank Harbin branch Pledgor: Beijing ahtech network Safe Technology Ltd Registration number: 2018990000700 |